SoK：机器学习用于网络入侵检测的务实评估
SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection
AI总结：
该研究针对网络入侵检测（NID）领域机器学习研究与实践脱节的问题，提出“务实评估”概念，通过覆盖多配置、多对抗场景、多硬件平台的大规模可复现评估及从业者用户研究，助力衡量ML方法的实际应用价值。
摘要：
机器学习（ML）已成为解决众多现实任务的宝贵工具。然而，在网络入侵检测（NID）领域，从业者对机器学习的科学进展仍持怀疑态度。这种脱节源于研究论文的范围本质有限，其中许多论文主要旨在证明新方法“优于”现有工作，却常常忽略了在真实系统中部署所提方案的实际影响。遗憾的是，机器学习对NID的价值取决于诸多因素，例如硬件，而这些因素在科学文献中常被忽视。\n本文旨在通过“改变”研究中采用的评估方法，减少从业者对NID领域机器学习的怀疑。在阐明影响机器学习在NID中实际部署的“因素”后，我们提出“务实评估”的概念，帮助从业者衡量机器学习方法对NID的实际价值。随后我们指出，当前的研究现状几乎无法让人估算机器学习对NID的价值。作为建设性的推进步骤，我们开展了一项务实评估：重新评估现有的NID机器学习方法，聚焦恶意网络流量分类，考量了数百种配置设置、多样的对抗场景以及四个硬件平台。我们的大规模可复现评估能够估算机器学习用于NID的质量，我们还通过与安全从业者开展的用户研究验证了相关结论。
英文摘要：
Machine Learning (ML) has become a valuable asset to solve many real-world tasks. For Network Intrusion Detection (NID), however, scientific advances in ML are still seen with skepticism by practitioners. This disconnection is due to the intrinsically limited scope of research papers, many of which primarily aim to demonstrate new methods ``outperforming'' prior work -- oftentimes overlooking the practical implications for deploying the proposed solutions in real systems. Unfortunately, the value of ML for NID depends on a plethora of factors, such as hardware, that are often neglected in scientific literature. This paper aims to reduce the practitioners' skepticism towards ML for NID by "changing" the evaluation methodology adopted in research. After elucidating which "factors" influence the operational deployment of ML in NID, we propose the notion of "pragmatic assessment", which enable practitioners to gauge the real value of ML methods for NID. Then, we show that the state-of-research hardly allows one to estimate the value of ML for NID. As a constructive step forward, we carry out a pragmatic assessment. We re-assess existing ML methods for NID, focusing on the classification of malicious network traffic, and consider: hundreds of configuration settings; diverse adversarial scenarios; and four hardware platforms. Our large and reproducible evaluations enable estimating the quality of ML for NID. We also validate our claims through a user-study with security practitioners.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
